SMB random reboot, especially during IPS Update time

[starmen2000]

Hi mates,

A customer has so many SMB 1500s in branch offices. And often the SMB gateways reboot randomly. Especially at night during IPS update time. Sometimes device does not come back, so no connectivity, in that case we have to reboot the device. Because of SMB device, we could not troubleshoot so much. As we generate Dr Spark report, it only shows the info at the time the report was executed. Any suggestion for further troubleshooting? or anyone expereinced this issue?

Thank you

[Chris_Atkinson]

Have you tested R81.10.07 on any of the troublesome devices?

[starmen2000]

Not yet. All of them has R81.10.05 Version. Do you think, that Software upgrade might help? 

[E_DDY]

Hi Starman,

We faced the same issue with IPS Updates.
We solved this by changing the IPS Update Policy on the SMB Appliance to "Use IPS Management Updates".

Hope this helps

[K_R_V]

The root cause may not be IPS update, but a restart of SFWD.

We have observed an issue with the SFWD process across all our 15XX firewalls. The process gradually consumes more memory until it reaches a specific threshold (sfwd_periodic_memory_rss), at which point SFWD is automatically restarted. It's worth noting that a restart of SFWD also triggers an IPS update.

According to Check Point R&D, it is considered normal for a process to not release memory and undergo several restarts throughout the day. This behavior leads to the consequential IPS updates.

In this scenario, it appears that SFWD is the primary concern, and the IPS update is merely a byproduct of the SFWD restarts.Do you also see SFWD often restarting ? ( cpwd_admin list to see the start time ) 

According to Check Point, R81.10.08 build 1711 is the stable version at this moment, so best to upgrade.